Interesting thought... NAT all source addresses to a common pool based on the interface, then somehow reverse it on the return path. I'll look into that. Am I mistaken in that this is a common requirement? Is the ASA just not designed for multiple outside connections? Or is having asymmetrical routes just the thing to do? It seems to put a lot of additional bandwidth on the default interface.
... View more
New to Cisco ASA in general. I'm replacing an aging, old, cheap firewall with some 5508s and I'm absolutely flummoxed on how to do this. I have multiple ISPs coming in. Both are active. These ISPs are generally used for incoming connections only, and it's imperative that all return traffic for a given connection goes out the same interface that it was built on. Outgoing connections from the ASA to the internet can do whatever the ASA wants. Thousands of locations may connect in over one or the other ISP. I can't provide routes for each one. My previous firewall did this automatically, and I just set up default routes for each interface and assigned one as last resort. But that doesn't seem to be the case for the ASA. I set up default routes for each interface using different metrics, and only the lowest metric shows up in the sh route command. Am I missing something obvious?
... View more
